feat(shares): R-7b Parts 1-2 — shares payload builder + tier-2 shares job (Model B')

Sibling shares source for the local cross-drive tier. Reuses the tier2Mirror seam,
selectTier2TargetFrom (narrow source-drive seam extracted from selectTier2Target),
tier2ReconcileRoots (pure extraction), tier2SafeRemove, the marker-LAST discipline
and the recordTier2* helpers. Per-app paths are untouched.

- shares_payload.go: deterministic _shares-manifest.json + best-effort passdb capture
- tier2_shares.go: per-source-drive legs -> cross-drive target, payload, marker LAST
- infra.SambaContainerName/SambaPassdbVolume/Mount: single source of truth for the
  container identity (renderer, stacks execs, backup execs, monitor all read it)
- RESERVED-NAME finding: ValidateSMBShareName did NOT exclude a leading underscore,
  so "_shares" was an accepted share name. Now refused; RunAllTier2 additionally
  skips a "_shares" stack loudly as defense in depth.
- fix: shareSourceDrive returned a slash-normalised path, which made the target
  selector's source-drive equality check miss (a group could target its own drive)

controller/internal/settings/smb.go

@@ -66,6 +66,15 @@ func ValidateSMBShareName(name string) error {
 	if strings.ContainsAny(name, `/\.` ) {
 		return fmt.Errorf("a megosztás neve nem tartalmazhat perjelet vagy pontot")
 	}
+	// RESERVED NAMESPACE (R-7b). The backup engines key the shares source by the pseudo-stack „_shares"
+	// — a restic tag, a tier-2 dest root and a status record. nbNameRe below starts with [A-Za-z0-9_],
+	// so before this guard „_shares" was an ACCEPTED share name and the underscore namespace was not in
+	// fact reserved (the R-7b task's assumption to the contrary was verified false here). Reserving the
+	// whole leading-underscore space keeps future system keys collision-free too. Validation runs on
+	// ADD only, so an already-registered share is never invalidated retroactively.
+	if strings.HasPrefix(name, "_") {
+		return fmt.Errorf("a megosztás neve nem kezdődhet aláhúzással — ezek a nevek a rendszernek vannak fenntartva")
+	}
 	if !nbNameRe.MatchString(name) {
 		return fmt.Errorf("a megosztás neve csak betűt, számot, kötőjelet és aláhúzást tartalmazhat")
 	}